CVE-2026-91668 is a high-severity vulnerability in Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low-privileged attacker with network access via SQL to fully compromise the product, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 8.8. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches addressing this and many other vulnerabilities.
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator. While the vulnerability is in Oracle Data Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Data Integrator accessible data as well as unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Studio). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset Assistant). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-60319 is a vulnerability in Oracle Data Integrator affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with logon access to the infrastructure where Oracle Data Integrator runs to compromise the product. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Data Integrator. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with significant confidentiality impact but no integrity or availability impact. The vulnerability may also affect additional products due to scope change. Oracle has published a Critical Patch Update advisory referencing this vulnerability but does not explicitly confirm patch availability for these versions in the provided data.
CVE-2026-60318 is a vulnerability in Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0 affecting the Patchset Assistant component. It allows a low privileged attacker with logon access to the infrastructure where Oracle Data Integrator runs to gain unauthorized read access to some accessible data. The vulnerability has a low severity with a CVSS 3.1 base score of 3.3, impacting confidentiality but not integrity or availability. No official patch or remediation level is currently stated in the vendor advisory. Oracle recommends applying security patches promptly and staying on supported versions. The vendor advisory does not explicitly confirm a patch for this specific vulnerability yet, so patch status is not confirmed and should be monitored via Oracle's security alerts.
CVE-2026-47056 is a critical vulnerability in Oracle Data Integrator versions 12.2.1.4.0 and 14.1.2.0.0 affecting the Rest Service component. It allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle Data Integrator, potentially leading to complete takeover. The vulnerability has a CVSS 3.1 base score of 10.0, indicating high impact on confidentiality, integrity, and availability. The vulnerability may also affect additional Oracle products due to scope change. Oracle has published a Critical Patch Update advisory for July 2026 addressing this and other vulnerabilities, but no specific patch details for this CVE are explicitly stated in the advisory content provided.
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Data Integrator accessible data as well as unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Data Integrator. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).